Burp Suite MCP Server

Instructions

Implementation Reference

• main.py:280-298 (handler)

  The main handler function for the check_burp_connectivity tool. Tests connectivity to Burp REST API by validating config and making a simple GET request to /knowledge_base/issue_definitions. Returns a success message if reachable or error message if not.

  @mcp.tool("check_burp_connectivity")
  async def check_burp_connectivity() -> str:
      """
      Test connectivity to the Burp REST API. Validates config and performs a simple request.
      """
      err = _validate_config()
      if err:
          return f"Configuration error: {err}"
  
      resp = await make_api_request("GET", "/knowledge_base/issue_definitions")
      if resp is not None:
          return (
              f"Burp API is reachable at {BURP_REST_API_BASE}. "
              "Configuration is valid and the API responded successfully."
          )
      return (
          f"Cannot reach Burp API at {BURP_REST_API_BASE}. "
          "Check that Burp is running, the REST API is enabled, and the API key is correct."
      )

• main.py:43-80 (helper)

  Helper function that makes HTTP requests to the Burp REST API. Handles authentication, URL construction, request execution, and error handling. Used by check_burp_connectivity to perform the actual API call.

  async def make_api_request(
      method: str, request_path: str, payload: dict[str, Any] | None = None
  ) -> httpx.Response | None:
      """
      Make a request to the Burp REST API.
      Returns None on failure; logs the error for debugging.
      """
      err = _validate_config()
      if err:
          logger.warning(err)
          return None
  
      path = request_path.lstrip("/")
      if BURP_REST_API_KEY:
          url = f"{BURP_REST_API_BASE}/{BURP_REST_API_KEY}/{BURP_REST_API_VERSION}/{path}"
      else:
          url = f"{BURP_REST_API_BASE}/{BURP_REST_API_VERSION}/{path}"
      async with httpx.AsyncClient() as client:
          try:
              response = await client.request(
                  method,
                  url,
                  json=payload,
                  headers=DEFAULT_HEADERS,
                  timeout=30,
              )
              response.raise_for_status()
              return response
          except httpx.HTTPStatusError as e:
              logger.warning(
                  "Burp API HTTP error: %s %s",
                  e.response.status_code,
                  e.response.text[:200],
              )
              return None
          except httpx.RequestError as e:
              logger.warning("Burp API request failed: %s", e)
              return None

• main.py:33-40 (helper)

  Helper function that validates environment configuration (BURP_REST_API_BASE). Returns an error message if configuration is invalid, None if valid. Called at the start of check_burp_connectivity.

  def _validate_config() -> str | None:
      """Validate env vars. Returns error message if invalid, None if ok."""
      if not BURP_REST_API_BASE:
          return (
              "Burp API not configured. Set BURP_REST_API_BASE in .env. "
              "See .env.example for reference."
          )
      return None